gentle-pi 2.2.0 → 2.4.0

package/tests/gentle-ai.test.ts

@@ -1,9 +1,11 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import test from "node:test";
+import { gzipSync } from "node:zlib";
+import { initTheme, keyHint } from "@earendil-works/pi-coding-agent";
 import type {
 	ExtensionAPI,
 	ExtensionContext,
@@ -11,24 +13,235 @@ import type {
 	ToolCallEventResult,
 } from "@earendil-works/pi-coding-agent";
 import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
-import { GATE_TARGET_KIND } from "../lib/review-publication-gate.ts";
-import {
-	REVIEW_MODE,
-	REVIEW_TRANSITION,
-	ReviewTransactionStore,
-	createReceiptForState,
-	createReviewState,
-	type ReviewBudgetV1,
-} from "../lib/review-transaction.ts";
-import { REVIEW_LENS, REVIEW_ROUTE } from "../lib/review-triggers.ts";
+import type { NativeReviewCli } from "../lib/native-review-cli.ts";
+import type { ReviewCollectInputV3, ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 import { stripAnsi } from "../lib/terminal-theme.ts";
-import { qualifiedReviewLockPlatform, testSnapshot } from "./review-test-fixtures.ts";
+
+initTheme("dark");
 
 function writeMarkdown(path: string, content: string): void {
 	mkdirSync(dirname(path), { recursive: true });
 	writeFileSync(path, content);
 }
 
+const lifecycleTheme = {
+	bold(value: string): string {
+		return value;
+	},
+	fg(color: string, value: string): string {
+		return `<${color}>${value}</${color}>`;
+	},
+};
+
+function renderComponent(component: { render(width: number): string[] }): string {
+	return component.render(120).map((line) => line.replace(/[ \t]+$/g, "")).join("\n");
+}
+
+function registeredGentleTools(): Map<string, any> {
+	const tools = new Map<string, any>();
+	const pi = {
+		on() {},
+		registerCommand() {},
+		registerTool(tool: { name: string }) {
+			tools.set(tool.name, tool);
+		},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+	return tools;
+}
+
+function lifecycleContext(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+	return {
+		executionStarted: false,
+		isPartial: true,
+		isError: false,
+		lastComponent: undefined,
+		...overrides,
+	};
+}
+
+test("registered Gentle Review tools render reusable rose lifecycle call rows", () => {
+	const tools = registeredGentleTools();
+	const cases = [
+		["gentle_review", { operation: "status" }, "review status"],
+		["gentle_review", { operation: "future-operation", secret: "/private" }, "review"],
+		["gentle_review_scope", {}, "review scope"],
+		["gentle_review_capture_group", {}, "review capture group"],
+		[
+			"gentle_review_capture",
+			{
+				lineageId: "lineage-id",
+				collectBinding: "binding-id",
+				sha256: "sha256:hash-value",
+				secret: "secret-value",
+				arbitrary: "arbitrary-value",
+			},
+			"review capture",
+		],
+	] as const;
+
+	assert.deepEqual(
+		[...new Set(cases.map(([name]) => name))].sort(),
+		[...tools.keys()].filter((name) => name.startsWith("gentle_")).sort(),
+	);
+
+	for (const [name, args, operationPath] of cases) {
+		const tool = tools.get(name);
+		assert.ok(tool, `missing ${name}`);
+		const initial = tool.renderCall(args, lifecycleTheme, lifecycleContext());
+		const initialText = renderComponent(initial);
+		const running = tool.renderCall(
+			args,
+			lifecycleTheme,
+			lifecycleContext({ executionStarted: true, lastComponent: initial }),
+		);
+		const runningText = renderComponent(running);
+		const completed = tool.renderCall(
+			args,
+			lifecycleTheme,
+			lifecycleContext({ executionStarted: true, isPartial: false, lastComponent: running }),
+		);
+		const completedText = renderComponent(completed);
+		const failed = tool.renderCall(
+			args,
+			lifecycleTheme,
+			lifecycleContext({ executionStarted: true, isPartial: false, isError: true, lastComponent: completed }),
+		);
+		const failedText = renderComponent(failed);
+
+		assert.strictEqual(initial, running);
+		assert.strictEqual(running, completed);
+		assert.strictEqual(completed, failed);
+		assert.equal(initialText, `<warning>🌹︎ Gentle AI · running · ${operationPath}</warning>`);
+		assert.equal(runningText, `<warning>🌹︎ Gentle AI · running · ${operationPath}</warning>`);
+		assert.equal(completedText, `<success>🌹︎ Gentle AI · completed · ${operationPath}</success>`);
+		assert.equal(failedText, `<error>🌹︎ Gentle AI · failed · ${operationPath}</error>`);
+		assert.doesNotMatch(renderComponent(failed), /future-operation|secret|private/);
+		for (const forbiddenValue of ["lineage-id", "binding-id", "sha256:hash-value", "secret-value", "arbitrary-value"]) {
+			assert.doesNotMatch(failedText, new RegExp(forbiddenValue));
+		}
+	}
+});
+
+test("registered Gentle Review tools preserve result envelopes and redact collapsed result rendering", async () => {
+	const tools = registeredGentleTools();
+	const scope = tools.get("gentle_review_scope");
+	const manifest = { version: 1, scopeByMode: { "100644": ["src/file.ts"] }, gitlinks: {} };
+	const bytes = Buffer.from(JSON.stringify(manifest), "utf8");
+	const encoded = gzipSync(bytes, { mtime: 0 }).toString("base64url");
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+
+	const result = await scope.execute(
+		"scope-call",
+		{ manifest: encoded, sha256, cursor: 0 },
+		undefined,
+		undefined,
+		{ cwd: process.cwd() } as ExtensionContext,
+	);
+	const visibleEnvelope = JSON.parse(result.content[0].text);
+	assert.deepEqual(visibleEnvelope, {
+		version: 1,
+		sha256,
+		cursor: 0,
+		totalPaths: 1,
+		entries: [{ path: "src/file.ts", mode: "100644" }],
+	});
+	assert.deepEqual(result.details, visibleEnvelope);
+
+	const resultText = "safe result\x1b[31m\nlineage=secret body=private";
+	const expandHint = keyHint("app.tools.expand", "to expand");
+	for (const name of ["gentle_review", "gentle_review_scope", "gentle_review_capture"]) {
+		const tool = tools.get(name);
+		assert.equal(typeof tool?.renderResult, "function", `${name} must define result rendering`);
+		for (const options of [
+			{ expanded: false, isPartial: true, isError: false },
+			{ expanded: false, isPartial: false, isError: false },
+			{ expanded: false, isPartial: false, isError: true },
+		]) {
+			const collapsed = renderComponent(tool.renderResult({ content: [{ type: "text", text: resultText }] }, options, lifecycleTheme, {}));
+			assert.equal(collapsed, expandHint, `${name} collapsed output must contain one expand hint`);
+			assert.equal(collapsed.split("\n")[0], expandHint, `${name} collapsed output must start with the hint`);
+			assert.doesNotMatch(collapsed, /safe result|lineage=secret|private/);
+		}
+		const expanded = renderComponent(tool.renderResult({ content: [{ type: "text", text: resultText }] }, { expanded: true, isPartial: false, isError: true }, lifecycleTheme, {}));
+		assert.equal(expanded.split("\n")[0], "safe result");
+		assert.match(expanded, /safe result/);
+		assert.match(expanded, /lineage=secret body=private/);
+		assert.doesNotMatch(expanded, /to expand/);
+		assert.doesNotMatch(expanded, /\x1b\[/);
+		const nonText = renderComponent(tool.renderResult({ content: [{ type: "image", data: "opaque", mimeType: "image/png" }] }, { expanded: true, isPartial: false }, lifecycleTheme, {}));
+		assert.equal(nonText, "");
+		const empty = renderComponent(tool.renderResult({ content: [{ type: "text", text: "" }] }, { expanded: false, isPartial: false }, lifecycleTheme, {}));
+		assert.equal(empty, "");
+	}
+});
+
+test("session startup reports invalid project routing without mutating the profile", async (t) => {
+	const root = mkdtempSync(join(tmpdir(), "gentle-pi-model-routing-startup-"));
+	const configHome = join(root, "global");
+	const projectConfigDir = join(root, ".pi", "gentle-ai");
+	const projectAgentsDir = join(root, ".pi", "agents");
+	const projectProfileDir = join(root, ".pi");
+	const rootAgentsDir = join(root, "agents");
+	const agentHome = join(root, "agent-home");
+	const agentHomeAgentsDir = join(agentHome, "agents");
+	const agentHomeSubagentsDir = join(agentHome, "subagents");
+	mkdirSync(configHome, { recursive: true });
+	mkdirSync(projectConfigDir, { recursive: true });
+	mkdirSync(projectAgentsDir, { recursive: true });
+	mkdirSync(projectProfileDir, { recursive: true });
+	mkdirSync(rootAgentsDir, { recursive: true });
+	mkdirSync(agentHomeAgentsDir, { recursive: true });
+	mkdirSync(agentHomeSubagentsDir, { recursive: true });
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+
+	const previousConfigHome = process.env.GENTLE_PI_CONFIG_HOME;
+	const previousAgentHome = process.env.GENTLE_PI_AGENT_HOME;
+	process.env.GENTLE_PI_CONFIG_HOME = configHome;
+	process.env.GENTLE_PI_AGENT_HOME = agentHome;
+	t.after(() => {
+		if (previousConfigHome === undefined) delete process.env.GENTLE_PI_CONFIG_HOME;
+		else process.env.GENTLE_PI_CONFIG_HOME = previousConfigHome;
+		if (previousAgentHome === undefined) delete process.env.GENTLE_PI_AGENT_HOME;
+		else process.env.GENTLE_PI_AGENT_HOME = previousAgentHome;
+	});
+
+	writeFileSync(join(projectConfigDir, "models.json"), "[]");
+	writeMarkdown(join(projectAgentsDir, "worker.md"), "---\nname: worker\ndescription: Worker\n---\nbody\n");
+	const profilePath = join(projectProfileDir, "subagents.json");
+	const profileBytes = `${JSON.stringify({ unrelated: { keep: true } }, null, 2)}\n`;
+	writeFileSync(profilePath, profileBytes);
+	const before = readFileSync(profilePath, "utf8");
+
+	const handlers = new Map<string, (event: unknown, ctx: ExtensionContext) => Promise<void>>();
+	const pi = {
+		on(name: string, handler: (event: unknown, ctx: ExtensionContext) => Promise<void>) {
+			handlers.set(name, handler);
+		},
+		registerCommand() {},
+		registerTool() {},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+	const sessionStart = handlers.get("session_start");
+	assert.equal(typeof sessionStart, "function");
+	const notifications: Array<{ message: string; severity: string }> = [];
+	await sessionStart!({}, {
+		cwd: root,
+		hasUI: true,
+		ui: {
+			notify(message: string, severity: string) {
+				notifications.push({ message, severity });
+			},
+		},
+	} as unknown as ExtensionContext);
+
+	const warning = notifications.find((entry) => entry.message.includes(join(projectConfigDir, "models.json")));
+	assert.ok(warning, JSON.stringify(notifications));
+	assert.equal(warning!.severity, "warning");
+	assert.match(warning!.message, /skipped model config/);
+	assert.equal(readFileSync(profilePath, "utf8"), before);
+});
+
 test("agent discovery skips skills directories", async (t) => {
 	const root = mkdtempSync(join(tmpdir(), "gentle-pi-agents-"));
 	t.after(() => rmSync(root, { recursive: true, force: true }));
@@ -54,12 +267,8 @@ test("agent discovery skips skills directories", async (t) => {
 	);
 });
 
-test("runtime guidance routes review intent to concrete lenses", () => {
-	const guidedFiles = [
-		"README.md",
-		"assets/orchestrator.md",
-		"skills/gentle-ai/SKILL.md",
-	];
+test("runtime guidance keeps review policy out of the static orchestrator", () => {
+	const staticReferences = ["README.md", "skills/gentle-ai/SKILL.md"];
 	const forbiddenGenericRoutes = [
 		/fresh-context `reviewer`/,
 		/fresh reviewer audits/,
@@ -67,15 +276,8 @@ test("runtime guidance routes review intent to concrete lenses", () => {
 		/run a fresh-context `reviewer`/,
 	];
 
-	for (const file of guidedFiles) {
-		// orchestrator-lazy-diet: the 4R/Review Lens content is split between the
-		// always-on core and `assets/orchestrator-delegation.md`. Only this one
-		// loop entry is repointed to the core+delegation-ref union; README.md and
-		// skills/gentle-ai/SKILL.md are unchanged single-file reads.
-		const content =
-			file === "assets/orchestrator.md"
-				? readFileSync(file, "utf8") + readFileSync("assets/orchestrator-delegation.md", "utf8")
-				: readFileSync(file, "utf8");
+	for (const file of staticReferences) {
+		const content = readFileSync(file, "utf8");
 		assert.match(content, /Review Lens Selection|review lens/);
 		assert.match(content, /review-risk/);
 		assert.match(content, /review-reliability/);
@@ -85,6 +287,93 @@ test("runtime guidance routes review intent to concrete lenses", () => {
 			assert.doesNotMatch(content, forbidden, `${file} must not route to generic reviewer`);
 		}
 	}
+
+	const orchestrator = readFileSync("assets/orchestrator.md", "utf8")
+		+ readFileSync("assets/orchestrator-delegation.md", "utf8");
+	assert.match(orchestrator, /injects the mirrored provider-bundle review execution contract/);
+	assert.match(orchestrator, /this package invents no lifecycle instructions/);
+	for (const lifecycleMarker of ["review-risk", "review-reliability", "review-resilience", "review-readability", "Authority-First Terminal Procedure", "reconcile-terminal-mirrors"]) {
+		assert.doesNotMatch(orchestrator, new RegExp(lifecycleMarker), `static orchestrator must not mirror ${lifecycleMarker}`);
+	}
+});
+
+test("ordinary native capture exposes a registered schema and STATUS binding copied unchanged to one slot", async (t) => {
+	const tools = new Map<string, { name: string; parameters: { required?: readonly string[] } }>();
+	const pi = {
+		on() {},
+		registerCommand() {},
+		registerTool(tool: { name: string; parameters: { required?: readonly string[] } }) {
+			tools.set(tool.name, tool);
+		},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+
+	assert.ok(tools.has("gentle_review_capture"));
+	assert.deepEqual(tools.get("gentle_review_capture")?.parameters.required, ["lineageId", "collectBinding"]);
+
+	const sha = `sha256:${"a".repeat(64)}`;
+	const lineageId = "ordinary-capture";
+	const collectInput: ReviewCollectInputV3 = {
+		name: "reviewer_result",
+		schema: "https://gentle-ai.dev/schema/review/reviewer/v1",
+		captureOperation: "review.capture-result",
+		arguments: [
+			{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
+			{ name: "target", value: sha, token: `--target=${sha}` },
+			{ name: "agent", value: "pi", token: "--agent=pi" },
+			{ name: "materialize", value: "true", token: "--materialize=true" },
+		],
+		submission: {
+			operationToken: "capture-result",
+			argumentTokens: ["--lineage=ordinary-capture", `--target=${sha}`, "--agent=pi", "--materialize=true", "--input={{value}}"],
+			values: [{ slot: "reviewer_result", domain: "artifact_path_or_stdin", substitutionLocation: 4 }],
+		},
+	};
+	const currentStatus = {
+		contract: "gentle-ai.review-integration/v2",
+		applicability: "current_target",
+		authority: { version: "compact-v2", lineageId, state: "reviewing", generation: 1, revision: sha },
+		action: "stop",
+		replayability: "not_replayable",
+		targetIdentity: sha,
+		projection: {
+			schema: "gentle-ai.review-candidate-projection/v1",
+			kind: "current-changes",
+			projection: "workspace",
+			baseTree: "b".repeat(40),
+			initialReviewTree: "b".repeat(40),
+			currentCandidateTree: "b".repeat(40),
+			pathsDigest: sha,
+			paths: ["app.ts"],
+			intendedUntracked: [],
+			intendedUntrackedProof: sha,
+			initialSnapshotIdentity: sha,
+			currentSnapshotIdentity: sha,
+		},
+		candidates: [],
+		nextTransition: { kind: "collect", reasonCode: "capture_required", collect: { inputs: [collectInput] } },
+		raw: { schema: "gentle-ai.review-integration.status/v5" },
+	} as unknown as ReviewStatusV3;
+	const native = { targetStatus: async () => currentStatus } as unknown as NativeReviewCli;
+
+	const publicStatus = await __testing.executeReviewControllerOperation({ operation: "status" }, process.cwd(), native);
+	const bindings = publicStatus.collectBindings as readonly { collectBinding: unknown }[];
+	assert.equal(bindings.length, 1);
+	assert.equal(typeof bindings[0]?.collectBinding, "string");
+
+	let launches = 0;
+	t.after(() => __testing.setReviewHostRelayRunnerForTesting());
+	__testing.setReviewHostRelayRunnerForTesting(async () => {
+		launches += 1;
+		return { promptByteLength: 1, resultByteLength: 1, submission: "{}" };
+	});
+	const captured = await __testing.executeReviewCaptureOperation({
+		lineageId,
+		collectBinding: bindings[0]!.collectBinding,
+		reviewerRunAcknowledged: true,
+	}, process.cwd(), native);
+	assert.equal(captured.status, "captured");
+	assert.equal(launches, 1);
 });
 
 test("agent model discovery prioritizes SDD and Judgment Day agents", (t) => {
@@ -168,135 +457,536 @@ test("model panel render uses the Pi-provided current theme when supplied", () =
 	assert.match(stripAnsi(rendered), /Assign Models and Effort to Agents/);
 });
 
-function runtimeBudget(): ReviewBudgetV1 {
-	return {
-		review_batches: 1,
-		review_actors: 1,
-		refuter_batches: 1,
-		fix_batches: 1,
-		validator_runs: 1,
-		final_verifications: 1,
-		judgment_rounds: 0,
-		judge_runs: 0,
-	};
-}
+test("delivery commands bypass RDD under every mode outcome while command safety remains independent", async () => {
+	type ToolCallHandler = (
+		event: { toolName: string; input: unknown },
+		ctx: ExtensionContext,
+	) => Promise<ToolCallEventResult | undefined>;
+	const commands = [
+		"git commit -m relay",
+		"git push origin feature/relay",
+		"gh pr create --base main --head feature/relay",
+		"gh release create v1.2.3",
+		"git status && git commit -m relay",
+		"env SAFE=1 git push origin feature/relay",
+		"sh -c 'gh pr create --base main --head feature/relay'",
+		"sh -c 'gh release create v1.2.3'",
+	] as const;
+	const modes = [
+		{ label: "no native CLI", nativeReviewCli: null },
+		{ label: "RDD off", nativeReviewCli: { reviewMode: async () => ({ status: { effective: "off" } }) } },
+		{ label: "RDD on", nativeReviewCli: { reviewMode: async () => ({ status: { effective: "on" } }) } },
+		{ label: "mode failure", nativeReviewCli: { reviewMode: async () => { throw new Error("mode unavailable"); } } },
+	] as const;
 
-function runtimeAuthority(t: test.TestContext) {
-	const parent = mkdtempSync(join(tmpdir(), "gentle-pi-runtime-gate-"));
-	const repository = join(parent, "repo");
-	mkdirSync(repository);
-	t.after(() => rmSync(parent, { recursive: true, force: true }));
-	const git = (...args: string[]): string =>
-		execFileSync("git", args, { cwd: repository, encoding: "utf8" }).trim();
-	git("init", "-b", "main");
-	writeFileSync(join(repository, "app.ts"), "export const value = 1;\n");
-	git("add", ".");
-	git("-c", "user.name=Runtime Gate", "-c", "user.email=runtime@example.invalid", "commit", "-m", "base");
-	const baseTree = git("rev-parse", "HEAD^{tree}");
-	writeFileSync(join(repository, "app.ts"), "export const value = 2;\n");
-	git("add", ".");
-	git("-c", "user.name=Runtime Gate", "-c", "user.email=runtime@example.invalid", "commit", "-m", "final");
-	const finalTree = git("rev-parse", "HEAD^{tree}");
-	const store = ReviewTransactionStore.forRepository(repository, { mutationLockPlatform: qualifiedReviewLockPlatform() });
-	store.create(createReviewState({
-		lineageId: "runtime-approved",
-		mode: REVIEW_MODE.ORDINARY,
-		snapshot: testSnapshot({
-			baseTree,
-			completeTree: finalTree,
-			route: REVIEW_ROUTE.STANDARD,
-			lenses: [REVIEW_LENS.READABILITY],
-		}),
-		evidenceHash: "b".repeat(64),
-		budget: runtimeBudget(),
-	}), "start-runtime-approved");
-	for (const [transition, input, idempotencyKey] of [
-		[REVIEW_TRANSITION.ORDINARY_DISCOVERY, { rows: [] }, "discover"],
-		[REVIEW_TRANSITION.ORDINARY_EVIDENCE, { deterministicResults: [] }, "evidence"],
-		[REVIEW_TRANSITION.ORDINARY_FINAL_VERIFICATION, { passed: true }, "verify"],
-	] as const) {
-		store.runReducerOperation({
-			lineageId: "runtime-approved",
-			transition,
-			idempotencyKey,
-			input,
-		});
+	for (const mode of modes) {
+		const handlers = new Map<string, ToolCallHandler>();
+		const pi = {
+			on(name: string, handler: ToolCallHandler) {
+				handlers.set(name, handler);
+			},
+			events: { emit() {} },
+			registerCommand() {},
+			registerTool() {},
+		} as unknown as ExtensionAPI;
+		createGentleAiExtension({ nativeReviewCli: mode.nativeReviewCli as never })(pi);
+		const toolCall = handlers.get("tool_call");
+		assert.equal(typeof toolCall, "function", mode.label);
+		const ctx = {
+			cwd: process.cwd(),
+			hasUI: true,
+			ui: { confirm: async () => true },
+		} as ExtensionContext;
+
+		for (const command of commands) {
+			const result = await toolCall!({ toolName: "bash", input: { command } }, ctx);
+			assert.equal(result, undefined, `${mode.label}: ${command}`);
+		}
 	}
-	return {
-		repository,
-		finalTree,
-		receipt: createReceiptForState(store.read("runtime-approved")),
-	};
-}
+});
 
-test("runtime lifecycle gates reject fabricated metadata while compound and wrapper forms fail closed", async (t) => {
+test("guarded command confirmation emits a generic correlated permission lifecycle", async () => {
 	type ToolCallHandler = (
 		event: { toolName: string; input: unknown },
 		ctx: ExtensionContext,
 	) => Promise<ToolCallEventResult | undefined>;
+	type PermissionEvent = {
+		channel: string;
+		data: {
+			requestId: string;
+			state: "waiting" | "approved" | "denied";
+			source: "tool_call";
+			message: string;
+			toolName: "bash";
+		};
+	};
+	type HerdrBlockedEvent = {
+		channel: "herdr:blocked";
+		data: { active: boolean; label?: string };
+	};
+	type EmittedEvent = PermissionEvent | HerdrBlockedEvent;
 	const handlers = new Map<string, ToolCallHandler>();
+	const emitted: EmittedEvent[] = [];
+	const sequence: string[] = [];
+	let confirm!: () => Promise<boolean>;
 	const pi = {
 		on(name: string, handler: ToolCallHandler) {
 			handlers.set(name, handler);
 		},
+		events: {
+			emit(channel: string, data: EmittedEvent["data"]) {
+				sequence.push(
+					channel === "herdr:blocked"
+						? `herdr:${"active" in data && data.active ? "active" : "inactive"}`
+						: `event:${data.state}`,
+				);
+				emitted.push({ channel, data } as EmittedEvent);
+			},
+		},
 		registerCommand() {},
 		registerTool() {},
 	} as unknown as ExtensionAPI;
 	createGentleAiExtension({ nativeReviewCli: null })(pi);
 	const toolCall = handlers.get("tool_call");
 	assert.equal(typeof toolCall, "function");
-	const authority = runtimeAuthority(t);
-	const ctx = {
-		cwd: authority.repository,
-		hasUI: false,
-	} as ExtensionContext;
+	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-permission-request-"));
+	try {
+		const ctx = {
+			cwd,
+			hasUI: true,
+			ui: {
+				confirm: async () => {
+					sequence.push("confirm");
+					return confirm();
+				},
+			},
+		} as ExtensionContext;
+		let resolveConfirmation!: (approved: boolean) => void;
+		confirm = () => new Promise<boolean>((resolve) => { resolveConfirmation = resolve; });
+		const denied = toolCall!({
+			toolName: "bash",
+			input: { command: "git rebase main --secret-command-content" },
+		}, ctx);
 
-	const fabricated = await toolCall!(
-		{
+		await Promise.resolve();
+		assert.equal(emitted[0].channel, "pi-permission-system:permission-request");
+		assert.equal(emitted[0].data.state, "waiting");
+		assert.deepEqual(emitted[1], {
+			channel: "herdr:blocked",
+			data: { active: true, label: "Guarded command confirmation" },
+		});
+		assert.deepEqual(sequence, ["event:waiting", "herdr:active", "confirm"]);
+		const deniedRequestId = emitted[0].data.requestId;
+		assert.match(deniedRequestId, /^[0-9a-f-]{36}$/);
+		assert.deepEqual(emitted[0].data, {
+			requestId: deniedRequestId,
+			state: "waiting",
+			source: "tool_call",
+			message: "Gentle AI safety policy requires confirmation for this tool call.",
 			toolName: "bash",
-			input: {
-				command: "git commit -m bounded",
-				reviewGate: {
-					receipt: authority.receipt,
-					target: {
-						kind: GATE_TARGET_KIND.INTENDED_COMMIT,
-						intended_commit_tree: authority.finalTree,
-					},
-					idempotencyKey: "runtime-commit",
-					scopeBudget: runtimeBudget(),
-				},
+		});
+		assert.equal(Object.keys(emitted[0].data).includes("command"), false);
+		assert.equal(Object.keys(emitted[0].data).includes("preview"), false);
+		assert.doesNotMatch(JSON.stringify(emitted), /secret-command-content|git rebase/);
+
+		resolveConfirmation(false);
+		assert.deepEqual(await denied, {
+			block: true,
+			reason: "Gentle AI safety policy blocked the command because it was not confirmed.",
+		});
+		assert.deepEqual(emitted[2], {
+			channel: "pi-permission-system:permission-request",
+			data: {
+				requestId: deniedRequestId,
+				state: "denied",
+				source: "tool_call",
+				message: "Gentle AI safety policy requires confirmation for this tool call.",
+				toolName: "bash",
+			},
+		});
+		assert.deepEqual(emitted[3], {
+			channel: "herdr:blocked",
+			data: { active: false },
+		});
+		assert.deepEqual(sequence, ["event:waiting", "herdr:active", "confirm", "event:denied", "herdr:inactive"]);
+
+		emitted.length = 0;
+		sequence.length = 0;
+		confirm = async () => true;
+		assert.equal(await toolCall!({ toolName: "bash", input: { command: "git rebase main" } }, ctx), undefined);
+		assert.equal(emitted.length, 4);
+		assert.equal(emitted[0].data.state, "waiting");
+		assert.deepEqual(emitted[1], {
+			channel: "herdr:blocked",
+			data: { active: true, label: "Guarded command confirmation" },
+		});
+		assert.equal(emitted[2].data.state, "approved");
+		assert.equal(emitted[0].data.requestId, emitted[2].data.requestId);
+		assert.notEqual(emitted[0].data.requestId, deniedRequestId);
+		assert.deepEqual(emitted[3], {
+			channel: "herdr:blocked",
+			data: { active: false },
+		});
+		assert.deepEqual(sequence, ["event:waiting", "herdr:active", "confirm", "event:approved", "herdr:inactive"]);
+
+		emitted.length = 0;
+		sequence.length = 0;
+		const confirmationError = new Error("confirmation unavailable");
+		confirm = async () => { throw confirmationError; };
+		await assert.rejects(
+			toolCall!({ toolName: "bash", input: { command: "git rebase main" } }, ctx),
+			(error) => error === confirmationError,
+		);
+		assert.equal(emitted.length, 4);
+		assert.equal(emitted[0].data.state, "waiting");
+		assert.deepEqual(emitted[1], {
+			channel: "herdr:blocked",
+			data: { active: true, label: "Guarded command confirmation" },
+		});
+		assert.equal(emitted[2].data.state, "denied");
+		assert.equal(emitted[0].data.requestId, emitted[2].data.requestId);
+		assert.deepEqual(emitted[3], {
+			channel: "herdr:blocked",
+			data: { active: false },
+		});
+		assert.deepEqual(sequence, ["event:waiting", "herdr:active", "confirm", "event:denied", "herdr:inactive"]);
+	} finally {
+		rmSync(cwd, { recursive: true, force: true });
+	}
+});
+
+test("concurrent guarded confirmations coalesce the Herdr lifecycle per extension instance", async () => {
+	type ToolCallHandler = (
+		event: { toolName: string; input: unknown },
+		ctx: ExtensionContext,
+	) => Promise<ToolCallEventResult | undefined>;
+	type EmittedEvent = {
+		channel: string;
+		data: {
+			requestId?: string;
+			state?: "waiting" | "approved" | "denied";
+			active?: boolean;
+			label?: string;
+		};
+	};
+	const createHarness = () => {
+		const handlers = new Map<string, ToolCallHandler>();
+		const emitted: EmittedEvent[] = [];
+		const confirmations: Array<(approved: boolean) => void> = [];
+		const pi = {
+			on(name: string, handler: ToolCallHandler) {
+				handlers.set(name, handler);
+			},
+			events: { emit(channel: string, data: EmittedEvent["data"]) { emitted.push({ channel, data }); } },
+			registerCommand() {},
+			registerTool() {},
+		} as unknown as ExtensionAPI;
+		createGentleAiExtension({ nativeReviewCli: null })(pi);
+		return { handlers, emitted, confirmations };
+	};
+	const first = createHarness();
+	const second = createHarness();
+	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-permission-concurrent-"));
+	try {
+		const context = (confirmations: Array<(approved: boolean) => void>) => ({
+			cwd,
+			hasUI: true,
+			ui: {
+				confirm: async () => new Promise<boolean>((resolve) => { confirmations.push(resolve); }),
+			},
+		} as ExtensionContext);
+		const firstRequest = first.handlers.get("tool_call")!({ toolName: "bash", input: { command: "git rebase main" } }, context(first.confirmations));
+		const secondRequest = first.handlers.get("tool_call")!({ toolName: "bash", input: { command: "git rebase main --another-command" } }, context(first.confirmations));
+		await Promise.resolve();
+		assert.deepEqual(first.emitted.map(({ channel, data }) => ({ channel, state: data.state, active: data.active })), [
+			{ channel: "pi-permission-system:permission-request", state: "waiting", active: undefined },
+			{ channel: "herdr:blocked", state: undefined, active: true },
+			{ channel: "pi-permission-system:permission-request", state: "waiting", active: undefined },
+		]);
+		assert.equal(first.confirmations.length, 2);
+		const waitingEvents = first.emitted.filter(({ channel, data }) => channel === "pi-permission-system:permission-request" && data.state === "waiting");
+		assert.notEqual(waitingEvents[0]?.data.requestId, waitingEvents[1]?.data.requestId);
+
+		first.confirmations[0]!(false);
+		assert.deepEqual(await firstRequest, {
+			block: true,
+			reason: "Gentle AI safety policy blocked the command because it was not confirmed.",
+		});
+		assert.deepEqual(first.emitted.map(({ channel, data }) => ({ channel, state: data.state, active: data.active })), [
+			{ channel: "pi-permission-system:permission-request", state: "waiting", active: undefined },
+			{ channel: "herdr:blocked", state: undefined, active: true },
+			{ channel: "pi-permission-system:permission-request", state: "waiting", active: undefined },
+			{ channel: "pi-permission-system:permission-request", state: "denied", active: undefined },
+		]);
+
+		const independentRequest = second.handlers.get("tool_call")!({ toolName: "bash", input: { command: "git rebase main --independent-command" } }, context(second.confirmations));
+		await Promise.resolve();
+		assert.equal(second.emitted.filter(({ channel }) => channel === "herdr:blocked").length, 1);
+		assert.equal(second.emitted.find(({ channel }) => channel === "herdr:blocked")?.data.active, true);
+		assert.equal(second.confirmations.length, 1);
+
+		first.confirmations[1]!(true);
+		assert.equal(await secondRequest, undefined);
+		assert.equal(first.emitted.filter(({ channel, data }) => channel === "herdr:blocked" && data.active === false).length, 1);
+		second.confirmations[0]!(true);
+		assert.equal(await independentRequest, undefined);
+		assert.deepEqual(second.emitted.map(({ channel, data }) => ({ channel, state: data.state, active: data.active })), [
+			{ channel: "pi-permission-system:permission-request", state: "waiting", active: undefined },
+			{ channel: "herdr:blocked", state: undefined, active: true },
+			{ channel: "pi-permission-system:permission-request", state: "approved", active: undefined },
+			{ channel: "herdr:blocked", state: undefined, active: false },
+		]);
+	} finally {
+		rmSync(cwd, { recursive: true, force: true });
+	}
+});
+
+
+test("RPIV questionnaire blockers emit only a private, balanced Herdr projection", () => {
+	type HerdrBlockedEvent = { active: boolean; label?: string };
+	const eventHandlers = new Map<string, (data: unknown) => void>();
+	const published: Array<{ channel: string; data: unknown }> = [];
+	const herdrEvents: HerdrBlockedEvent[] = [];
+	const pi = {
+		on() {},
+		events: {
+			emit(channel: string, data: unknown) {
+				published.push({ channel, data });
+				if (channel === "herdr:blocked") herdrEvents.push(data as HerdrBlockedEvent);
+				const handler = eventHandlers.get(channel);
+				if (handler) handler(data);
+			},
+			on(channel: string, handler: (data: unknown) => void) {
+				eventHandlers.set(channel, handler);
+				return () => eventHandlers.delete(channel);
 			},
 		},
-		ctx,
+		registerCommand() {},
+		registerTool() {},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+	assert.equal(eventHandlers.size, 2);
+	assert.equal(eventHandlers.has("gentle-pi:ask-user-choice:blocked"), true);
+	assert.equal(eventHandlers.has("rpiv:ask-user:blocked"), true);
+
+	const source = {
+		active: true,
+		question: "private questionnaire text",
+		answer: "private questionnaire answer",
+		path: "/private/questionnaire-path",
+		command: "private questionnaire command",
+		arbitrary: { nested: "private questionnaire field" },
+	};
+	pi.events.emit("rpiv:ask-user:blocked", source);
+	assert.strictEqual(published[0]?.data, source, "the RPIV event remains the source event");
+	assert.deepEqual(herdrEvents, [{ active: true, label: "Questionnaire awaiting input" }]);
+	assert.doesNotMatch(JSON.stringify(herdrEvents), /private questionnaire|questionnaire-path/i);
+
+	pi.events.emit("rpiv:ask-user:blocked", { active: true, duplicate: true });
+	pi.events.emit("rpiv:ask-user:blocked", { active: "true" });
+	pi.events.emit("rpiv:ask-user:blocked", { active: null });
+	pi.events.emit("rpiv:ask-user:blocked", []);
+	pi.events.emit("rpiv:ask-user:blocked", null);
+	pi.events.emit("rpiv:ask-user:other", { active: false });
+	assert.deepEqual(herdrEvents, [{ active: true, label: "Questionnaire awaiting input" }]);
+
+	pi.events.emit("rpiv:ask-user:blocked", { active: false });
+	pi.events.emit("rpiv:ask-user:blocked", { active: false, duplicate: true });
+	pi.events.emit("rpiv:ask-user:blocked", { active: true });
+	pi.events.emit("rpiv:ask-user:blocked", { active: false });
+	assert.deepEqual(herdrEvents, [
+		{ active: true, label: "Questionnaire awaiting input" },
+		{ active: false },
+		{ active: true, label: "Questionnaire awaiting input" },
+		{ active: false },
+	]);
+});
+
+test("Herdr coordinates guarded confirmations and RPIV labels without inactive relabel pulses", async () => {
+	type ToolCallHandler = (
+		event: { toolName: string; input: unknown },
+		ctx: ExtensionContext,
+	) => Promise<ToolCallEventResult | undefined>;
+	type HerdrBlockedEvent = { active: boolean; label?: string };
+	const createHarness = () => {
+		const handlers = new Map<string, ToolCallHandler>();
+		const eventHandlers = new Map<string, (data: unknown) => void>();
+		const herdrEvents: HerdrBlockedEvent[] = [];
+		const confirmations: Array<(approved: boolean) => void> = [];
+		const pi = {
+			on(name: string, handler: ToolCallHandler) {
+				handlers.set(name, handler);
+			},
+			events: {
+				emit(channel: string, data: unknown) {
+					if (channel === "herdr:blocked") herdrEvents.push(data as HerdrBlockedEvent);
+					const handler = eventHandlers.get(channel);
+					if (handler) handler(data);
+				},
+				on(channel: string, handler: (data: unknown) => void) {
+					eventHandlers.set(channel, handler);
+					return () => eventHandlers.delete(channel);
+				},
+			},
+			registerCommand() {},
+			registerTool() {},
+		} as unknown as ExtensionAPI;
+		createGentleAiExtension({ nativeReviewCli: null })(pi);
+		const context = {
+			cwd: process.cwd(),
+			hasUI: true,
+			ui: {
+				confirm: async () => new Promise<boolean>((resolve) => { confirmations.push(resolve); }),
+			},
+		} as ExtensionContext;
+		return { confirmations, context, herdrEvents, pi, toolCall: handlers.get("tool_call")! };
+	};
+
+	const guardedFirst = createHarness();
+	const guardedRequest = guardedFirst.toolCall(
+		{ toolName: "bash", input: { command: "git rebase main" } },
+		guardedFirst.context,
 	);
-	assert.equal(fabricated?.block, true);
-	assert.match(fabricated?.reason ?? "", /registered review controller authorization/i);
+	await Promise.resolve();
+	guardedFirst.pi.events.emit("rpiv:ask-user:blocked", { active: true });
+	guardedFirst.confirmations[0]!(true);
+	assert.equal(await guardedRequest, undefined);
+	assert.deepEqual(guardedFirst.herdrEvents, [
+		{ active: true, label: "Guarded command confirmation" },
+		{ active: true, label: "Questionnaire awaiting input" },
+	]);
+	guardedFirst.pi.events.emit("rpiv:ask-user:blocked", { active: false });
+	assert.deepEqual(guardedFirst.herdrEvents, [
+		{ active: true, label: "Guarded command confirmation" },
+		{ active: true, label: "Questionnaire awaiting input" },
+		{ active: false },
+	]);
 
-	const lifecycle = await toolCall!(
-		{ toolName: "bash", input: { command: "git commit -m bounded" } },
-		ctx,
+	const questionnaireFirst = createHarness();
+	questionnaireFirst.pi.events.emit("rpiv:ask-user:blocked", { active: true });
+	const questionnaireRequest = questionnaireFirst.toolCall(
+		{ toolName: "bash", input: { command: "git rebase main" } },
+		questionnaireFirst.context,
 	);
-	assert.equal(lifecycle?.block, true);
-	assert.match(lifecycle?.reason ?? "", /approved receipt.*exact typed command target/i);
-	for (const command of [
-		"git status && git commit -m compound",
-		"env SAFE=1 git commit -m wrapped",
-		"command git commit -m wrapped",
-		"sh -c 'git commit -m wrapped'",
-		"git \\\n commit -m continued",
-		`git -c safe.long=${"x".repeat(8_192)} commit -m long-direct`,
-		`sh -c 'git -c safe.long=${"x".repeat(8_192)} commit -m long-wrapped'`,
-	]) {
-		const wrapped = await toolCall!({ toolName: "bash", input: { command } }, ctx);
-		assert.equal(wrapped?.block, true, command);
-		assert.match(wrapped?.reason ?? "", /compound or wrapped lifecycle command.*fail closed/i);
-	}
+	await Promise.resolve();
+	questionnaireFirst.pi.events.emit("rpiv:ask-user:blocked", { active: false });
+	questionnaireFirst.confirmations[0]!(false);
+	await questionnaireRequest;
+	assert.deepEqual(questionnaireFirst.herdrEvents, [
+		{ active: true, label: "Questionnaire awaiting input" },
+		{ active: true, label: "Guarded command confirmation" },
+		{ active: false },
+	]);
+});
+
+test("closed choice blockers retain the visible choice label through guarded-confirmation overlap", async () => {
+	type ToolCallHandler = (
+		event: { toolName: string; input: unknown },
+		ctx: ExtensionContext,
+	) => Promise<ToolCallEventResult | undefined>;
+	type HerdrBlockedEvent = { active: boolean; label?: string };
+	const handlers = new Map<string, ToolCallHandler>();
+	const eventHandlers = new Map<string, (data: unknown) => void>();
+	const herdrEvents: HerdrBlockedEvent[] = [];
+	const choiceEvents: Array<{ active: boolean }> = [];
+	const confirmations: Array<(approved: boolean) => void> = [];
+	const pi = {
+		on(name: string, handler: ToolCallHandler) {
+			handlers.set(name, handler);
+		},
+		events: {
+			emit(channel: string, data: unknown) {
+				if (channel === "herdr:blocked") herdrEvents.push(data as HerdrBlockedEvent);
+				if (channel === "gentle-pi:ask-user-choice:blocked") choiceEvents.push(data as { active: boolean });
+				eventHandlers.get(channel)?.(data);
+			},
+			on(channel: string, handler: (data: unknown) => void) {
+				eventHandlers.set(channel, handler);
+				return () => eventHandlers.delete(channel);
+			},
+		},
+		registerCommand() {},
+		registerTool() {},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+	assert.equal(eventHandlers.has("gentle-pi:ask-user-choice:blocked"), true);
 
-	const destructive = await toolCall!(
-		{ toolName: "bash", input: { command: "git push --force origin main" } },
-		ctx,
+	pi.events.emit("gentle-pi:ask-user-choice:blocked", { active: true });
+	assert.deepEqual(choiceEvents, [{ active: true }]);
+	assert.deepEqual(herdrEvents, [{ active: true, label: "Choice awaiting input" }]);
+
+	const guardedRequest = handlers.get("tool_call")!(
+		{ toolName: "bash", input: { command: "git rebase main" } },
+		{
+			cwd: process.cwd(),
+			hasUI: true,
+			ui: {
+				confirm: async () => new Promise<boolean>((resolve) => { confirmations.push(resolve); }),
+			},
+		} as ExtensionContext,
 	);
-	assert.equal(destructive?.block, true);
-	assert.match(destructive?.reason ?? "", /safety policy blocked a destructive shell command/i);
-	assert.doesNotMatch(destructive?.reason ?? "", /approved receipt/i);
+	await Promise.resolve();
+	assert.equal(confirmations.length, 1);
+	assert.deepEqual(herdrEvents, [{ active: true, label: "Choice awaiting input" }]);
+
+	pi.events.emit("gentle-pi:ask-user-choice:blocked", { active: false });
+	assert.deepEqual(choiceEvents, [{ active: true }, { active: false }]);
+	assert.deepEqual(herdrEvents, [
+		{ active: true, label: "Choice awaiting input" },
+		{ active: true, label: "Guarded command confirmation" },
+	]);
+	assert.equal(herdrEvents.some((event) => event.active === false), false);
+
+	confirmations[0]!(true);
+	assert.equal(await guardedRequest, undefined);
+	assert.deepEqual(herdrEvents, [
+		{ active: true, label: "Choice awaiting input" },
+		{ active: true, label: "Guarded command confirmation" },
+		{ active: false },
+	]);
+});
+
+test("permission lifecycle is inactive for unguarded and headless commands", async () => {
+	type ToolCallHandler = (
+		event: { toolName: string; input: unknown },
+		ctx: ExtensionContext,
+	) => Promise<ToolCallEventResult | undefined>;
+	const handlers = new Map<string, ToolCallHandler>();
+	const emitted: unknown[] = [];
+	let confirmations = 0;
+	const pi = {
+		on(name: string, handler: ToolCallHandler) {
+			handlers.set(name, handler);
+		},
+		events: { emit(_channel: string, data: unknown) { emitted.push(data); } },
+		registerCommand() {},
+		registerTool() {},
+	} as unknown as ExtensionAPI;
+	createGentleAiExtension({ nativeReviewCli: null })(pi);
+	const toolCall = handlers.get("tool_call");
+	assert.equal(typeof toolCall, "function");
+	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-permission-headless-"));
+	try {
+		const confirm = async () => {
+			confirmations += 1;
+			return true;
+		};
+		assert.equal(await toolCall!({ toolName: "bash", input: { command: "echo safe --secret-command-content" } }, {
+			cwd,
+			hasUI: false,
+			ui: { confirm },
+		} as ExtensionContext), undefined);
+		assert.deepEqual(await toolCall!({ toolName: "bash", input: { command: "git rebase main" } }, {
+			cwd,
+			hasUI: false,
+			ui: { confirm },
+		} as ExtensionContext), {
+			block: true,
+			reason: "Gentle AI safety policy requires interactive confirmation before this command.",
+		});
+		assert.equal(confirmations, 0);
+		assert.deepEqual(emitted, []);
+	} finally {
+		rmSync(cwd, { recursive: true, force: true });
+	}
 });